As a security practitioner, if you have, at some point in your career, had to answer the question: “why should security always impose difficulty on legitimate business users?”, you’re not alone. A lot of business users struggle to see the values that security adds to the business. It’s neither their fault not their responsibility to figure it